HTMLy vulnerabilities

An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component.

A vulnerability in danpros HTMLy up to 3.1.1, affecting the unlink function in /system/htmly.php of the Delete Username Endpoint component, allows manipulation of the File argument leading to path traversal. The attack can be launched remotely, and the exploit is publicly available.

A cross-site scripting (XSS) vulnerability was detected in htmly up to version 3.1.0 in the /htmly/admin/field/post file of the Custom Field Handler component. Manipulating the label argument leads to malicious script execution. The exploit has been publicly disclosed, and the vendor did not respond to the report.

A cross-site scripting (XSS) vulnerability in Htmly v2.8.1 allows attackers to execute arbitrary HTML scripts via a crafted payload in the content field of a blog post.